54 Commits

Author	SHA1	Message	Date
petermmm	b6c4e64a9b	fixed attack category number 2->3	2019-05-12 11:59:13 +02:00
petermmm	2778558ae3	added rule .bash_profile and .bashrc T1156	2019-05-12 02:07:13 +02:00
Thomas Patzke	46c789105b	Fix and ordering	2019-05-10 00:08:26 +02:00
patrick	ca4b710c01	Added Sigma Use Case detecting Privilege Escalation Preparation in Linux	2019-04-07 15:36:19 +02:00
Florian Roth	2b814011cd	Merge pull request #287 from P4T12ICK/feature/lnx-clear-cmd-history-signature ... Add new signature for linux clear command history	2019-04-03 19:45:06 +02:00
Florian Roth	6cc1770351	Merge pull request #294 from Pr0t3an/patch-3 ... Update lnx_shell_susp_rev_shells.yml	2019-04-03 01:07:07 +02:00
Florian Roth	b76925f838	Rule: extending rule with /dev/udp	2019-04-02 20:09:13 +02:00
Pr0t3an	d067087632	Update lnx_shell_susp_rev_shells.yml ... added - 'bash -i >& /dev/udp/' - 'sh -I >$ /dev/udp/' - 'sh -i >$ /dev/tcp/'	2019-04-02 18:22:18 +01:00
Florian Roth	5c5a16c4d5	Rule: adding xterm -display string to rule	2019-04-02 18:48:18 +02:00
Florian Roth	453bd10e6e	Rule: Suspicious reverse shell command lines	2019-04-02 17:03:57 +02:00
Florian Roth	d06a5431eb	Changes	2019-04-01 14:03:54 +02:00
patrick	0242c40360	Add new signature for linux clear command history	2019-03-24 10:10:14 +01:00
Florian Roth	5092b1e603	Rule: removed overlapping strings in Linux rule	2019-02-05 16:12:07 +01:00
Florian Roth	32c098294f	Rule: extended suspicious command lines	2019-02-05 15:58:15 +01:00
Florian Roth	b92c032c2d	Linux JexBoss back connect shell	2018-11-08 23:21:36 +01:00
Florian Roth	6bde2cd08f	Update lnx_buffer_overflows.yml	2018-08-25 00:20:34 +02:00
Florian Roth	234a48af19	rule: Linux SSHD exploit CVE-2018-15473 ... https://github.com/Rhynorater/CVE-2018-15473-Exploit	2018-08-24 16:40:41 +02:00
Florian Roth	9e0abc5f0b	Adjusted rules to the new specs reg "not null" usage	2018-06-28 09:30:31 +02:00
Alexandre ZANNI	74da324d8f	remove old public_html ... remove old public_html	2018-05-29 11:44:38 +02:00
Alexandre ZANNI	a1de770b64	enhance web server paths ... - specify when it is apache only - add Per-user path - add archlinux paths	2018-05-29 11:41:36 +02:00
Thomas Patzke	59eff939f2	Merge branch 'devel-sigmac'	2018-03-04 22:59:41 +01:00
Thomas Patzke	4792700726	Fixed rule	2018-03-04 22:07:01 +01:00
Florian Roth	b88a81a9e1	Rule: Linux > named > suspicious activity	2018-02-20 14:56:28 +01:00
Florian Roth	ef0cd4c110	Rules: Extended and fixed (*) sshd rules	2018-02-20 13:44:06 +01:00
SherifEldeeb	348728bdd9	Cleaning up empty list items	2018-01-28 02:36:39 +03:00
SherifEldeeb	48441962cc	Change All "str" references to be "list"to mach schema update	2018-01-28 02:24:16 +03:00
SherifEldeeb	112a0939d7	Change "reference" to "references" to match new schema	2018-01-28 02:12:19 +03:00
Florian Roth	aca70e57ec	Massive Title Cleanup	2018-01-27 10:57:30 +01:00
Florian Roth	f31ed7177e	Added status 'experimental' to newly created auditd rules	2018-01-23 11:15:02 +01:00
Florian Roth	fe80ae7885	Rule: Linux auditd 'program execution in suspicious folders'	2018-01-23 11:13:23 +01:00
Florian Roth	228ca1b765	Rule: Linux auditd 'suspicious commands'	2018-01-23 11:13:23 +01:00
Thomas Patzke	5c465129bd	Fixed rules ... * Replaced unspecified logsource attribute 'type' with 'category' * Usage of service 'auth' for linux logs	2017-09-11 00:35:52 +02:00
Thomas Patzke	f768bf3d61	Fixed parse errors	2017-08-02 22:49:15 +02:00
Florian Roth	fc4cd4036e	Linux: Suspicious VSFTPD errors	2017-07-05 18:59:51 -06:00
Florian Roth	ead63fbf75	Linux: Suspicious SSHD errors	2017-06-30 08:47:56 +02:00
Florian Roth	004fed24e0	Linux Generic Rules	2017-05-02 20:32:38 +02:00
Florian Roth	67d9c44bb3	Improved linux suspicious activity rule	2017-03-27 15:21:39 +02:00
Florian Roth	c5323ac1c2	Changes to Linux suspicious activity rule	2017-03-27 10:29:57 +02:00
Florian Roth	5c4a13af71	Rules: Linux commands and log entries of interest	2017-03-25 19:59:45 +01:00
Florian Roth	c8cc857b7c	Improved the linux suspicious keywords rule	2017-03-25 19:23:10 +01:00
Florian Roth	6932fcec65	Rule: Linux shell more suspicious keywords	2017-03-21 10:23:12 +01:00
Florian Roth	789b3899df	Improved Linux Shell Activity Rule	2017-03-15 09:07:59 +01:00
Florian Roth	9afa12f4a3	Further shell commands from MSF repo	2017-03-14 16:33:51 +01:00
Florian Roth	daeb7c3693	Rule: Suspicious activity in shell commands	2017-03-14 14:54:08 +01:00
Florian Roth	546a587df7	Rule: Shellshock Regex detection ... http://rubular.com/r/zxBfjWfFYs	2017-03-14 14:53:29 +01:00
Florian Roth	3eae1f2710	Bug and typo fixes	2017-03-14 14:52:28 +01:00
Florian Roth	9934a66a3c	Rule: ClamAV	2017-03-01 10:00:17 +01:00
Florian Roth	2e0632b05f	Rule: Linux: buffer overflows	2017-03-01 08:38:33 +01:00
Florian Roth	001bed0c45	ModSecurity rule: multiple blocks	2017-02-28 17:53:32 +01:00
Florian Roth	b1446f9b87	Removed 'last' keyword from 'timeframe' fields	2017-02-28 17:52:40 +01:00